Hub: accounts, IMVU linking by tagline, proxy sign-in, presence, console

People sign up on the website and link IMVU accounts by putting a code in the account's tagline, which the
hub reads from IMVU's public API (the most recent proof wins; link caps per person). IMVU's age verification
or Access Pass make an account adult. T5DE's proxy signs in with a device code and keeps a WebSocket open,
reporting the IMVU account in use and the community products it wears; /online shows those who opted in.
Moderators get a console: who's online, people, link caps, bans, roles, and the audit log. Tests run the
website and API against an embedded Postgres and a fake IMVU API.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/design.md

@@ -279,8 +279,8 @@ One Go program in modules (split into services only if load requires it):
 - **Moderation**: reports, actions, blocklist, audit log.
 - **Website and console** (**Decided**: in this repo): browse catalogs, products, creators, rooms, news; manage
   accounts (links, privacy, data export and deletion); catalog operators' screens; moderation console.
-  **Decided**: server-rendered. Proposed: templ (Go templates) and htmx, built into the program: fast, cacheable at
-  Cloudflare, indexable, no JS build. How it looks comes from its CSS (a small design system of our own), not from
+  **Decided**: server-rendered. Built with Go's html/template (no code generation step) and htmx, embedded in the
+  program: fast, cacheable at Cloudflare, indexable, no JS build. How it looks comes from its CSS (a small design system of our own), not from
   rendering on the server; small scripts where a page needs richer interaction (image galleries, drag and drop).
 
 ### Data (sketch)
@@ -333,6 +333,13 @@ The proxy streams and adds no waiting.
 - Catalogs see addresses of those fetching adult files (with a token) and of uploaders.
 - All stated in the setup and on the website.
 
+## Status
+
+- Phase 1 (local packs) done: t5de-api, t5de-proxy `internal/products`.
+- Phase 2 (hub identity) started: accounts, tagline linking, age, link caps, device sign-in, presence and badge,
+  console. Not yet: periodic age re-checks (only on demand), a sign-in UI in the client (the proxy's `signin`
+  command for now), deployment.
+
 ## Phases
 
 1. Spec (`t5de-api`); local product packs, removing community items from what IMVU sees, creator live preview. No